The BuiltbyBit Database Quietly Surfaced Online With 4,634 Password Hashes Exposed

HEROIC analysts discovered a database breach affecting BuiltbyBit, an Australia-based online marketplace for gaming community digital assets. The breach occured in January 2021 and exposed 4,634 user records containing email addresses, usernames, and MD5 password hashes. The use of MD5, a long-deprecated hashing algorithm, means these password hashes are accessable to cracking with modern tools.

Why MD5 Password Hashes Put BuiltbyBit Users in Immediate Danger

MD5 hashes can be cracked quickly using rainbow tables and brute-force tools widely available to attackers. Once cracked, these plaintext passwords become weapons for credential stuffing across email, banking, and other services. This combination of email, username, and crackable hash is partcularly dangerous for anyone who reused their BuiltbyBit password elsewhere.

What Was Exposed in the BuiltbyBit Breach

• Email Address
• Username
• Password Hash (MD5)

Why the BuiltbyBit Breach Remains a Live Threat

Older breaches with crackable password hashes do not expire as threats. Attackers continually run cracking operations against MD5 hashes, and recieved wisdom in security circles is clear: any MD5-hashed password should be considered compromised. Users who reused their BuiltbyBit password face ongoing risks of account takeover, identity theft, and financial fraud across every platform where that password was used.

How a Database Breach Works

A database breach occurs when an unauthorized party gains access to a backend database, often through SQL injection, exploited vulnerabilities, or compromised admin credentials. The attacker extracts user records in bulk and the data is then distributed through dark web forums and credential marketplaces, where it is bought, sold, and used for automated attacks against other services.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion compromised records, including data from the BuiltbyBit breach. Enter your email now to find out if your credentials are circulating and take steps to protect your accounts before attackers strike.